Send all the notifications at once without warning, and the real recipient will probably see it before the attacker programs his malware to hide this specific notification.

Obviously, that only really works once.